Accessing apps over environments and vnets.

Here is an approach for setting up secure communication between Azure Container Apps A and B across different environments and VNETs

The following setup ensure the connection between the vnets and allows communciations using FQDNs without dynamic IPs which is mentioned in your approach.

My configuration:

resource "azurerm_virtual_network_peering" "peer_a_to_b" {
  name                      = "peer-a-to-b"
  resource_group_name        = azurerm_resource_group.rg_app_a.name
  virtual_network_name       = azurerm_virtual_network.vnet_a.name
  remote_virtual_network_id  = azurerm_virtual_network.vnet_b.id
  allow_virtual_network_access = true
}

resource "azurerm_virtual_network_peering" "peer_b_to_a" {
  name                      = "peer-b-to-a"
  resource_group_name        = azurerm_resource_group.rg_app_b.name
  virtual_network_name       = azurerm_virtual_network.vnet_b.name
  remote_virtual_network_id  = azurerm_virtual_network.vnet_a.id
  allow_virtual_network_access = true
}

resource "azurerm_log_analytics_workspace" "log_analytics" {
  name                = "log-analytics-demo"
  resource_group_name = azurerm_resource_group.rg_app_a.name
  location            = azurerm_resource_group.rg_app_a.location
  sku                 = "PerGB2018"
  retention_in_days   = 30
}

resource "azurerm_container_app_environment" "env_a" {
  name                       = "container-env-a"
  location                   = azurerm_resource_group.rg_app_a.location
  resource_group_name        = azurerm_resource_group.rg_app_a.name
  infrastructure_subnet_id   = azurerm_subnet.subnet_a.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.log_analytics.id
}

resource "azurerm_container_app_environment" "env_b" {
  name                       = "container-env-b"
  location                   = azurerm_resource_group.rg_app_b.location
  resource_group_name        = azurerm_resource_group.rg_app_b.name
  infrastructure_subnet_id   = azurerm_subnet.subnet_b.id
  log_analytics_workspace_id = azurerm_log_analytics_workspace.log_analytics.id
}

resource "azurerm_container_app" "app_a" {
  name                         = "container-app-a"
  resource_group_name          = azurerm_resource_group.rg_app_a.name
  container_app_environment_id = azurerm_container_app_environment.env_a.id
  revision_mode                = "Single"

  ingress {
    external_enabled           = false
    target_port                = 80
    allow_insecure_connections = false

    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }

  template {
    container {
      name   = "appvksba"    # Updated to comply with naming restrictions
      image  = "${azurerm_container_registry.registry.login_server}/mycontainer:latest"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }

  depends_on = [ azurerm_private_dns_zone.dns_zone ]
}

resource "azurerm_container_app" "app_b" {
  name                         = "container-app-b"
  resource_group_name          = azurerm_resource_group.rg_app_b.name
  container_app_environment_id = azurerm_container_app_environment.env_b.id
  revision_mode                = "Single"

  ingress {
    external_enabled           = false
    target_port                = 80
    allow_insecure_connections = false

    traffic_weight {
      percentage      = 100
      latest_revision = true
    }
  }

  template {
    container {
      name   = "appvksbb"   
      image  = "${azurerm_container_registry.registry.login_server}/mycontainer:latest"
      cpu    = 0.25
      memory = "0.5Gi"
    }
  }
  depends_on = [ azurerm_private_dns_zone.dns_zone ]
}

resource "azurerm_private_dns_zone" "dns_zone" {
  name                = "privatelink.internal"
  resource_group_name = azurerm_resource_group.rg_app_a.name
}

resource "azurerm_private_dns_zone_virtual_network_link" "vnet_a_link" {
  name                  = "vnet-a-link"
  resource_group_name   = azurerm_resource_group.rg_app_a.name
  private_dns_zone_name = azurerm_private_dns_zone.dns_zone.name
  virtual_network_id    = azurerm_virtual_network.vnet_a.id
}

resource "azurerm_private_dns_zone_virtual_network_link" "vnet_b_link" {
  name                  = "vnet-b-link"
  resource_group_name   = azurerm_resource_group.rg_app_a.name
  private_dns_zone_name = azurerm_private_dns_zone.dns_zone.name
  virtual_network_id    = azurerm_virtual_network.vnet_b.id
}

resource "azurerm_private_dns_cname_record" "app_b_cname" {
  name                = "appvksbb"
  zone_name           = azurerm_private_dns_zone.dns_zone.name
  resource_group_name = azurerm_resource_group.rg_app_a.name
  record              = azurerm_container_app.app_b.latest_revision_fqdn
  ttl                 = 300
}

this much better approach as this using VNET peering and private DNS ensures stable internal routing wthout relying on dynamic IPs.

Refer:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-peering-overview

https://registry.terraform.io/providers/hashicorp/azurerm/latest/docs/resources/virtual_network_peering

https://learn.microsoft.com/en-us/azure/container-apps/networking?tabs=workload-profiles-env%2Cazure-cli